Main issue is that you have your work e-mail on your pocket, and can see them 24/7
this post was submitted on 07 Oct 2024
72 points (96.2% liked)
Asklemmy
43974 readers
660 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy π
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- [email protected]: a community for finding communities
~Icon~ ~by~ ~@Double_[email protected]~
founded 5 years ago
MODERATORS
Don't.
Two reasons:
Many employers require you to install phone-management software as part of the data loss mitigation/data exfiltration requirements - and those requirements might be set by their insurers.
This gives them the ability to remotely lock or wipe your phone at any time - useful to them because they remove company data if you lose your phone, or you leave the company, or are suspended for any reason. Obviously that'll also lose any personal data on the phone, but that's your problem, not theirs. They can also monitor its location and similar things.
That's obviously a reason why you should never, ever, use a work-issued device for personal use - besides it being against their acceptable use policy. If your employer requires you to check email then they are required to issue you the means to do so. They cannot insist that you use any personal devices for that.
It's bad for your mental health.
Keep work to work hours. Keep work devices for work. Keep personal hours and devices for your personal use.
This physical separation requires a little discipline but, having been on all sides of this barrier (employer, employee, suffering with poor mental health, and currently, in good mental health) - I know this to be the only way to achieve a health balance.
I'm forgetting the episode but darknet diaries podcast had one where a guy took revenge against a former employer and wiped out an entire schools email system and wiped all phones that has logged into the school email. This was done from compromising the school's outlook admin account.
That was the first time i learned that logging into the employer email could give them the level of control over your device. Fortunately i never have done that for the #2 reason.
load more comments
(1 replies)
This is great context, thanks.
A followup question, if you don't mind. I am running stock android 14, which offers multiple users. My main user account is my personal (nothing work related), and a second user account is my work profile, complete with phone-management software. The two accounts are based upon different Google accounts.
If my work were to remote wipe, I have assumed that would only affect the (second) user profile which has those apps, and not the main user account.
Do you know if that is correct?
If my work were to remote wipe, I have assumed that would only affect the (second) user profile which has those apps, and not the main user account.
My understanding is that these tools offer a factory reset, so they would wipe everything. After all - if the phone is stolen, you wouldn't want to just wipe one profile and leave data within another.
Duo is Cisco's version of authentication. The only permissions it has on my phone is notifications.
In its current form, it doesn't appear to let your company's IT department control your phone.
Do you have any concerns about having it? I mostly don't want my phone activities or location tracked.
How specific? Most companies can tell if you are connecting to the mail server from an IP in a different city without needing any app to do that.
Just within the city, doing paperwork from home instead of at a campus.
your IP will be the easy give away if they care to audit. a possible solution is to VPN to the campus and nat your traffic from a campus IP, but now we are getting into additional questionable action.
If theyβre on their phone they should just make sure they donβt connect to their home WiFi or their campus WiFi on their phone during work hours. All anyone will see them connecting with then is their cell network IP, prolly just an ipv6 address, and there wonβt ever be an obvious tell that they are in a specific location in town.
load more comments
(1 replies)
If you are accessing your work email through your phone, you're going to be pinging the server with your phone's IP address. Duo isn't adding any tracking beyond that.
Iβve got duo; we had to have it at my uni for 2FA for our school emails. As far as I can tell it really isnβt very invasive. That said, I do think it tracks general location but I donβt believe it goes further than that.
Duo tracks your location. Not exact location but IP address and city.
Only IP address. Location days from IP address is a guess at best
If you have an android phone you can make a work and home profile so the two sessions are totally separate. It does mean swapping back ans forth between profiles.
No more swapping on modern Android. The apps just run side-by-side.
Im still having to swap User in the MultiUser profiles, if I want them sandboxed as separate. Do you have another method?
load more comments
(2 replies)
load more comments
(10 replies)
+1 to being out of contact β It can honestly wait until the next time youβre near a work computer. (Iβm hoping a work laptop or something is involved here.)
load more comments
(3 replies)
Ask for a physical device like a yubikey instead of the duo app.
Use the web browser to access email.
I have a 6 year old work ipad and we buy our own toner cartridges for our office printer. They're not buying anything. They put millions into door-swiping, staff-tracking security but we have playgrounds that don't have fences. Public education is super fucked up.
I think they cost $20. Either this, nothing, or give in and give them access.
Iβm a huge proponent of Yubikeys, and I use them every day. I use it for every account I have that supports non-resident FIDO2. I have my ssh keys set up on there so i can just sit down at any computer and ssh in to my remote servers without having to rely on being on a computer with its pub key already on the server. I use it for my pgp keys. I use it for TOTP on a few of my more sensitive accounts that donβt support anything better.
In addition to my regular w2 9-5 pen testing job I do pen testing as a contractor for a place like hacker one on steroids. I am forced to use Duo by them. Canβt use another TOTP app, canβt use a yubikey. While in most cases you can use another TOTP instead of duo, it is not always possible. That said, I highly doubt a school system has set up Duo in a way that prevents you from using alternate TOTP apps.
I had never heard of it. I'll do some reading.
Please don't be a hero. Work your 40 hours and then stop. You didn't clarify, but I'm slightly worried that you want to be more connected which might lead you to increase your workload or working hours, and that will make your job less sustainable in the long run, and we really want people like you to stick around for many years to come.
Oh no, I'm definitely not looking to put in more than 40 hours. I spend most of my day driving from school to school and i just want my teachers to be able to reach me- without giving my cell to everyone. Also, i share a one-room office with 15 people, so i like to do meetings and paperwork from home even though I'm not supposed to. Thank you for your concern.
load more comments
(3 replies)
I've managed Duo installations. The administrator can see your phone number, your device os and version, history of authentication attempts.
I would never mix private data with work related data. You should get a second phone for work related things. As pointed out by others, it may be technically possible to have both on the phone without interfering with each other (which also would be more convenient), but keeping things separated physically has another advantage: Data you are handling/ generating at work belongs to your employer. This means that he can demand (problbly backed up by law) to search your phone when things should go south in the future. You don't want your employer to have a peek at your personal phone, do you? Also, your employer might want you to install tracking/ logging software to make sure you really do the work. By having a dedicated phone for work related stuff your private stuff is out of focus.
You should get a second phone for work related things
Slight correction: OP's employer should get him a second device if they require him to access work email away from his office during work hours.
People have already answered well enough though many of them mention IP addresses and you said you were non techy so wanted to add this
Giving away your IP address is not that big a deal, you do it every time you visit a website without a VPN or connect to pretty much any web service
(You still shouldn't post it publicly of course but it's unlikely your employer is going to dox you, and if they do it's probably illegal)
You can always get a cheap prepaid burner
It's a slippery slope. They may require your phone to have password or Microsoft intune. Plus, they will know you have it on your phone.
Duo is just a widely used third party multifactor authentication app, which is useful for organizational cybersecurity.
I had it on my phone for years working at a hospital and really never had any privacy concerns with it the way I have with other apps. The convenience of being able to respond to work emails on your phone is totally worth it
Duo does location tracking. It also can perform device attestation
Are you sure it has permission to track your location? I'm not seeing that one. Either way, they share nothing with your employer
I use a S23 Ultra and have my work profile on a sandbox environment with Knox, I can also turn it off at the end of the day and while normally work could have access to my personal data, knox blocks that.
If it's Android, set up a work profile and put the VPN and email on that.
load more comments
(3 replies)
view more: next βΊ